Skip to content

menu

Open Legal Blog Archive logo
HomeAboutBlogsFAQsSubmit

So, if I don’t respond to an access request, can I get sued?

By David A. Zetoony on February 16, 2021
corporate cybersecurity

No.

The CCPA permits consumers to “institute a civil action” only where consumer “nonencrypted or nonredacted personal information” is “subject to an unauthorized access and exfiltration, theft, or disclosure.” [1] The CCPA does not provide a private right of action, nor does it provide statutory damages, if a company violates its obligation to disclose to consumers information about their data upon request, or fails to provide “the specific pieces of personal information” collected about a consumer.[2] In other words, the CCPA does not envision that consumers can bring suit if a business fails to respond in time to an access request, or fails to include each piece of personal information that was collected from the consumer.

[1] Cal. Civ. Code 1798.150(a)(1).

[2] Cal. Civ. Code 1798.110(a)(5). Note, however, that the CCPA permits the California Attorney General to pursue civil penalties.

  • Posted in:
    Privacy & Data Security
  • Blog:
    Data Privacy Dish
  • Organization:
    Greenberg Traurig, LLP
  • Article: View Original Source

Open Legal Blog Archive, Inc. logo
Seattle, Washington
Copyright © 2026, Open Legal Blog Archive, Inc. All Rights Reserved.
Law blog design & platform by LexBlog LexBlog Logo